oban_sentinel

# Security Policy

## Scope and guarantees

ObanSentinel helps contain repeated job failures and excessive BEAM-process
memory use. It is not a sandbox, malware boundary, database circuit breaker,
or OS-level resource controller.

In particular, `max_memory` and `max_memory_mb` inspect the guarded task's BEAM
memory only. They do not limit native extensions, ports, external executables,
or total VM memory. Use operating-system or container limits for hard isolation.

## Safe deployment

- Begin with `action: :emit_only` and observe tripped telemetry before allowing
  automatic queue pauses.
- Use a secret manager or runtime environment variable for webhook URLs. Never
  commit webhook URLs, access tokens, or job payloads.
- Treat `snapshot/2` as operational metadata; expose it only through an
  authenticated, authorized admin interface.
- Use separate queues for unrelated workers to reduce circuit blast radius.
- Set `auto_recover: false` when manual queue maintenance is authoritative.

## Reporting vulnerabilities

Please report security vulnerabilities privately to the project maintainers.
Do not include credentials, sensitive job arguments, or reproduction payloads
in public issues.